v2.0.0-rc.1

2.0.0-rc.1 🎉

This is a release candidate for the upcoming v2 of Nuxt Security.

A+ Score by default

Our new version delivers an A+ security rating by default on both the Mozilla Observatory and SecurityHeaders.com
Our documentation page is deployed with Nuxt-Security and is tested on these two scanners:

Performance optimization

We are considerably improving the performance of Nuxt Security with this release, by removing all dependency from cheerio.
Applications running in lightweight environments such as workers, will benefit from significantly reduced CPU and memory usage, and increased page delivery.

Many thanks to @GalacticHypernova for leading the full rewrite of our HTML parsing engine 💚

All Nuxt modes

Security headers are now deployed in all Nuxt rendering modes:

• Universal
• Client-only
• Hybrid

See #441 for details.

OWASP compliance

We are updating our default security settings to conform with the latest OWASP default values for headers.
Users benefit from these updating settings out of the box, with no changes required.

See #450 for details.

Full static support

We are significantly improving application security for static websites:

• If the site is deployed with a Nitro Preset, security headers are now delivered natively. Netlify and Vercel static presets have been fully tested.
• If the site is deployed in a custom environment (e.g. bare-metal server), we provide a new prerenderedHeaders build-time hook that exposes all security headers for complete control of your server's headers.

Other features

• We now conform to the HTML5 standard when inserting the CSP http-equip meta tag.
• We now support all unstorage drivers options for the RateLimiter. Users can fully use any supported driver (Redis, Vercel KV, etc.)

👉 Changelog
compare changes

❤️ Contributors

• @GalacticHypernova

What's Changed

• feat(core): use virtual file system for SRI by @vejja in #435
• feat(core): Security Headers for Pre-rendered Routes by @vejja in #441
• feat(docs): add security to docs by @vejja in #451
• perf: avoid cheerio in favor of regex by @GalacticHypernova in #404
• fix(csp): ensure charset meta at top of head by @vejja in #449
• fix(docs): update FAQ section on --host mode by @vejja in #456
• feat(core) : owasp default values by @vejja in #450
• fix(core): spread storage options by @vejja in #452
• fix: remove navigate-to csp directive by @GalacticHypernova in #457
• fix(types): allow middleware props to be optional when specified in global config by @GalacticHypernova in #458